Control Identification Document For Free

You should write the control description in the present tense and as a factual statement of what is in place or you think should be in place. If the control is not yet implemented you should still adhere to this.

Actual controls can be identified from discussion with the auditee, observation, review of process documentation and risk registers / board assurance framework. Perform a walk-through to confirm controls are in place.

To identify the correct control(s) to implement, you must know what risks are present. To know what risks are present, you need to understand what objectives are being sought. Therefore, Objectives ? Risks? Controls.

5. What are the main types of control? Controls are usually categorised as either Preventive, Detective or Reactive. This is based primarily on where in a risk's life do they apply and as a result, do they modify the likelihood and or the impact of the risk.

Risk identification (RI) is a set of activities that detect, describe and catalog all potential risks to assets and processes that could have negatively impact business outcomes in terms of performance, quality, damage, loss or reputation.

As part of the engagement process, auditors obtain an understanding of controls and the control environment relevant to the audit, determine whether these controls prevent or mitigate assessed risks, and report on any deficiencies.

To assess control risk for specific assertions at less than the maximum for the financial statement audit, you are required to obtain evidence that the relevant controls operated effectively during the entire period upon which you plan to place reliance on those controls.